Mmm, we probably want to traverse the filesystem to gather up the list of entries to watch-or-unwatch as close to the point in time that we actually perform the watch-or-unwatch command to mitigate differences between our current view of the filesystem and the reality. Of course, we're racing against the operating system no matter what, but in this case I think it's better to make it less likely instead of more that the race will cause something unexpected.